{"cve":"CVE-2022-1054","nvd":{"published":"2022-04-18T18:15:08.847","modified":"2026-06-17T04:21:44.470","status":"Modified","description":"The RSVP and Event Management Plugin WordPress plugin before 2.7.8 does not have any authorisation checks when exporting its entries, and has the export function hooked to the init action. As a result, unauthenticated attackers could call it and retrieve PII such as first name, last name and email address of user registered for events","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-862"],"references":["https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d","https://wpscan.com/vulnerability/95a5fad1-e823-4571-8640-19bf5436578d"],"products":["wpchill:rsvp_and_event_management"],"source":"nvd","synced_at":"2026-10-19T21:30:03.577988018+00:00"},"epss":{"cve":"CVE-2022-1054","score":0.04213,"percentile":0.90985,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}